CVE-2026-64579

A flaw was found in the Linux kernel's xfrm policy component. An issue in the xfrm_hash_rebuild() function, specifically with the preallocation of inexact policy bins, can lead to memory allocation failures under memory pressure. This failure can corrupt internal data structures, allowing a local attacker to trigger a kernel panic, resulting in a denial of service.

A flaw of moderate severity was found in the Linux kernel's xfrm (IPsec) policy subsystem. The preallocation loop in xfrm_hash_rebuild() has an inverted guard: it preallocates for exact-match policies, which never allocate during reinsertion, while skipping the inexact policies whose bins are allocated with GFP_ATOMIC during the reinsert phase. If that allocation fails under memory pressure, the error path only emits a warning and leaves a poisoned bydst list node; the next policy hash rebuild dereferences that poisoned pointer in hlist_del_rcu(), causing a general protection fault and a kernel panic. A local attacker with the ability to create or modify xfrm policies (typically requiring CAP_NET_ADMIN) could exploit this to crash the system, resulting in a denial of service. Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 are affected; Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are not affected because the vulnerable code is not present in those kernels. Because exploitation is local-only, requires elevated privileges and allocation failure under memory pressure, and the impact is limited to availability, the fix is currently deferred for the affected streams; the residual risk is a local denial of service with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.